From 7e9d9b4ff08da447bd43aff0a500202c668d7b32 Mon Sep 17 00:00:00 2001 From: David Byron Date: Thu, 10 Aug 2023 09:20:47 -0700 Subject: [PATCH] chore(dependencies): remove unnecessary dependency on log4j-core and make dependencies on log4j-api explicit. https://github.com/spinnaker/kork/pull/1069 introduced the dependency on org.apache.logging.log4j.log4j-core in kork-artifacts, but it's not necessary. At least, after removing it, and verifying the dependency is gone from $ ./gradle kork-artifacts:dependencies the code still builds fine. As well $ git grep "import org.apache.logging.log4j" kork-secrets/src/main/java/com/netflix/spinnaker/kork/secrets/user/UserSecretTypeProvider.java:import org.apache.logging.log4j.LogManager; kork-security/src/main/java/com/netflix/spinnaker/security/AuthenticatedRequestDecorator.java:import org.apache.logging.log4j.ThreadContext; turns up classes present in log4j-api, but nothing in log4j-core. As well uses of the @Log4j2 annotation depend on log4j-api (see https://projectlombok.org/api/lombok/extern/log4j/Log4j2) $ git grep @Log4j2 kork-artifacts/src/main/java/com/netflix/spinnaker/kork/artifacts/artifactstore/ArtifactStoreConfiguration.java:@Log4j2 kork-artifacts/src/main/java/com/netflix/spinnaker/kork/artifacts/artifactstore/s3/S3ArtifactStore.java:@Log4j2 kork-core/src/main/java/com/netflix/spinnaker/kork/jackson/JsonTypeNameParser.java:@Log4j2 kork-credentials/src/main/java/com/netflix/spinnaker/credentials/jackson/SensitiveSerializer.java:@Log4j2 kork-secrets/src/main/java/com/netflix/spinnaker/kork/secrets/EncryptedSecret.java:@Log4j2 This all makes the comment in spinnaker-dependencies.gradle true again: Per analysis, log4j-core is not included in dependencies --- kork-artifacts/kork-artifacts.gradle | 1 - kork-core/kork-core.gradle | 1 + kork-credentials/kork-credentials.gradle | 1 + kork-secrets/kork-secrets.gradle | 1 + kork-security/kork-security.gradle | 1 + 5 files changed, 4 insertions(+), 1 deletion(-) diff --git a/kork-artifacts/kork-artifacts.gradle b/kork-artifacts/kork-artifacts.gradle index 9a12ae570..7efbb1594 100644 --- a/kork-artifacts/kork-artifacts.gradle +++ b/kork-artifacts/kork-artifacts.gradle @@ -14,7 +14,6 @@ dependencies { implementation "org.springframework.boot:spring-boot-autoconfigure" implementation "org.springframework.security:spring-security-core" implementation 'org.apache.logging.log4j:log4j-api' - implementation 'org.apache.logging.log4j:log4j-core' api "com.hubspot.jinjava:jinjava" testImplementation "org.assertj:assertj-core" diff --git a/kork-core/kork-core.gradle b/kork-core/kork-core.gradle index ed6e91f18..064452767 100644 --- a/kork-core/kork-core.gradle +++ b/kork-core/kork-core.gradle @@ -18,6 +18,7 @@ dependencies { api "io.github.resilience4j:resilience4j-retry" api "io.github.resilience4j:resilience4j-spring-boot2" + implementation "org.apache.logging.log4j:log4j-api" implementation "com.fasterxml.jackson.core:jackson-annotations" implementation "com.fasterxml.jackson.core:jackson-databind" implementation "com.netflix.spectator:spectator-ext-gc" diff --git a/kork-credentials/kork-credentials.gradle b/kork-credentials/kork-credentials.gradle index 1901bd0c0..0e7a3458d 100644 --- a/kork-credentials/kork-credentials.gradle +++ b/kork-credentials/kork-credentials.gradle @@ -21,6 +21,7 @@ dependencies { api project(":kork-credentials-api") api project(":kork-annotations") implementation(platform(project(":spinnaker-dependencies"))) + implementation 'org.apache.logging.log4j:log4j-api' implementation "org.springframework.boot:spring-boot" implementation 'org.springframework.boot:spring-boot-starter-json' implementation 'javax.annotation:javax.annotation-api' diff --git a/kork-secrets/kork-secrets.gradle b/kork-secrets/kork-secrets.gradle index 84d149213..e926a4799 100644 --- a/kork-secrets/kork-secrets.gradle +++ b/kork-secrets/kork-secrets.gradle @@ -14,6 +14,7 @@ dependencies { implementation "org.yaml:snakeyaml" implementation "com.google.guava:guava" implementation "org.apache.commons:commons-lang3" + implementation "org.apache.logging.log4j:log4j-api" testImplementation "com.hubspot.jinjava:jinjava" testImplementation "org.spockframework:spock-core" diff --git a/kork-security/kork-security.gradle b/kork-security/kork-security.gradle index 336ea06af..3ef147dd6 100644 --- a/kork-security/kork-security.gradle +++ b/kork-security/kork-security.gradle @@ -11,6 +11,7 @@ dependencies { api "com.fasterxml.jackson.core:jackson-annotations" implementation "com.google.guava:guava" + implementation "org.apache.logging.log4j:log4j-api" implementation "org.slf4j:slf4j-api" testImplementation "org.spockframework:spock-core"